Cyber Posture

CVE-2025-21084

Low

Published: 04 March 2025

Published
04 March 2025
Modified
04 March 2025
KEV Added
Patch
CVSS Score 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS Score 0.0008 23.6th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-21084 is a low-severity NULL Pointer Dereference (CWE-476) vulnerability in Openatom Openharmony. Its CVSS base score is 3.8 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the NULL pointer dereference vulnerability in OpenHarmony by applying vendor-provided patches from the security advisory.

prevent

Implements memory protection mechanisms such as address space randomization and non-executable stacks to prevent arbitrary code execution from NULL pointer dereferences.

prevent

Requires secure error handling to detect and gracefully manage NULL pointer conditions, reducing the risk of exploitation for code execution.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local low-privileged attacker exploiting NULL pointer dereference for arbitrary code execution in pre-installed apps directly enables T1068 Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through through NULL pointer dereference.. This vulnerability can be exploited only in restricted scenarios.

Deeper analysisAI

CVE-2025-21084 is a NULL pointer dereference vulnerability (CWE-476) affecting OpenHarmony versions v5.0.2 and prior. Published on 2025-03-04, it enables a local attacker to achieve arbitrary code execution within pre-installed applications.

The vulnerability can be exploited by a local attacker with low privileges (PR:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation is confined to restricted scenarios and results in low confidentiality impact (C:L) with no integrity or availability effects (I:N/A:N), though the scope is changed (S:C), yielding a CVSS v3.1 base score of 3.8.

Mitigation guidance is available in the OpenHarmony security disclosure advisory at https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md.

Details

CWE(s)

Affected Products

openatom
openharmony
4.1.0 — 5.0.2

CVEs Like This One

CVE-2025-24309Same product: Openatom Openharmony
CVE-2025-20626Same product: Openatom Openharmony
CVE-2025-20091Same product: Openatom Openharmony
CVE-2025-0587Same product: Openatom Openharmony
CVE-2025-0304Same product: Openatom Openharmony
CVE-2025-24301Same product: Openatom Openharmony
CVE-2025-23240Same product: Openatom Openharmony
CVE-2025-0303Same product: Openatom Openharmony
CVE-2025-23409Same product: Openatom Openharmony
CVE-2025-23414Same product: Openatom Openharmony

References